Hi Jonathan, On 07.11.2019 13:37, GATHMAN, JONATHAN C wrote: > Greetings, > May I assume that your need for 127.0.0.1 is so you can develop with? > > Some History: > Security Policies from the past tend to frown on "localhost", because some > people wrote code that assumed if processes on running on the box, they are > secure. This is not a good assumption. Also, 127.0.0.1, as an IP, is not > unique... Every box has one. __
That's a good assumptions for stuff that are running "in the box" or in VM but not for containers. As we are moving towards more cloud native deployment your application should listen on all available interfaces unless you are using multus or stuff like that. But then you probably have some policy where to listen for the incoming traffic. Otherwise you should just trust that that people who deploy your application know how to ensure its security by defining a proper network policy for k8s cluster and attaching proper type of network interfaces to your container. > > For that reason, SOME Security tooling (at least ones that AAF supports at > AT&T) denies the use of 127.0.0.1 or "localhost". I do appreciate good security practices in ATT and their positive influence on ONAP, but as long as we are talking about ONAP open source project policies should be defined by the community not by a single company. > > What to do instead: > > What works better is to come up with a valid name. For my local AAF > Instances, I use "aaf.osaaf.org" (my ONAP Namespace). I then enter that name > into /etc/hosts with supporting IP from "minikube" (which is how I run K8s). > > Ex > 192.168.64.1 aaf.osaaf.org > > At this point, everything is validly running that I need in my K8s private > net, and, of course, not accessible externally. > > For AAF, we get "hostname" onto a property file in docker through the use of > "Init" docker. Let me know if you need to explore that part. > For me this sounds like some nasty hack to just bypass some "clever" security tooling that greps for localhost keyword in the repo;) There should be a proper way of just making the application listen on whatever you want 0.0.0.0 or localhost or whatever. Best regards, -- Krzysztof Opasiak Samsung R&D Institute Poland Samsung Electronics -=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#19381): https://lists.onap.org/g/onap-discuss/message/19381 Mute This Topic: https://lists.onap.org/mt/45686190/21656 Group Owner: [email protected] Unsubscribe: https://lists.onap.org/g/onap-discuss/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
